[SECURITY] Linux: extracting a symlink with ACLs modifies ACLs of target

[mmatuska]

When an archive entry contains a symbolic link that has defined ACLs on Linux, on extraction the ACLs of the link target are modified. This is because the function acl_set_file() is used without a prior check if the file is not a symbolic link.

FreeBSD and MacOS use acl_set_link_np() that does not follow symbolic links.

[ret2libc]

Can Red Hat assign a CVE for this security issue? Or was it already requested to MITRE?

[ret2libc]

ping @mmatuska

[carnil]

Looks CVE-2021-23177 was assigned for this issue.